CVE-2026-93311
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
A vulnerability was detected in Freedesktop Poppler 26.07.0. The issue affects the SampledFunction::SampledFunction function in poppler/Function.cc, where manipulation of the BitsPerSample argument results in integer overflow. The attack can be performed remotely and the exploit is publicly available.
Risk Assessment
Integer overflow may lead to unexpected behavior or crashes in applications using Poppler, potentially allowing remote disruption or code execution.
Recommendation
Monitor vendor communications and apply the patch when available. Temporarily restrict trust in unverified PDF documents processed by Poppler.
Other vulnerabilities in Poppler
See all- CVE-2017-15565High
In Poppler 0.59.0, a NULL Pointer Dereference exists in the GfxImageColorMap::getGrayLine() function in GfxState.cc via a crafted PDF document.
- CVE-2017-14977High
The FoFiTrueType::getCFFBlock function in Poppler 0.59.0 has a NULL pointer dereference vulnerability due to lack of validation of a table pointer, which allows an attacker to launch a denial of service attack.
- CVE-2017-14976High
The FoFiType1C::convertToType0 function in Poppler 0.59.0 has a heap-based buffer over-read vulnerability when encountering an out-of-bounds font dictionary index. This can be exploited by an attacker to launch a denial of service attack.
- CVE-2017-14975High
The FoFiType1C::convertToType0 function in Poppler 0.59.0 has a NULL pointer dereference vulnerability because a data structure is not initialized, allowing an attacker to launch a denial of service attack.
- CVE-2017-14929High
In Poppler 0.59.0, memory corruption occurs in a call to Object::dictLookup() in Object.h after a repeating series of Gfx::display, Gfx::go, Gfx::execOp, Gfx::opFill, Gfx::doPatternFill, Gfx::doTilingPatternFill, and Gfx::drawForm calls. This is a different vulnerability than CVE-2017-14519.
- CVE-2017-14617High
In Poppler 0.59.0, a floating point exception occurs in the ImageStream class in Stream.cc, which may lead to a potential attack when handling malicious PDF files.
- CVE-2017-14520High
In Poppler 0.59.0, a floating point exception occurs in Splash::scaleImageYuXd() in Splash.cc, which may lead to a potential attack when handling malicious PDF files.
- CVE-2017-14519High
In Poppler 0.59.0, memory corruption occurs in a call to Object::streamGetChar in Object.h after a repeating series of Gfx::display, Gfx::go, Gfx::execOp, Gfx::opShowText, and Gfx::doShowText calls (aka a Gfx.cc infinite loop).
- CVE-2017-14518High
In Poppler 0.59.0, a floating point exception exists in the isImageInterpolationRequired() function in Splash.cc via a crafted PDF document.
- CVE-2017-2820High
An exploitable integer overflow vulnerability exists in the JPEG 2000 image parsing functionality of Poppler 0.53.0. Opening a specially crafted PDF file can lead to an overflow, resulting in out of bounds memory overwrite on the heap and potential arbitrary code execution.
Original NVD description (English source)
A vulnerability was detected in Freedesktop Poppler 26.07.0. This issue affects the function SampledFunction::SampledFunction of the file poppler/Function.cc of the component SampledFunction. The manipulation of the argument BitsPerSample results in integer overflow. The attack may be performed from remote. The exploit is now public and may be used. The project was informed of the problem early through a bug report but has not responded yet.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS